[devin-ai-integration]

Dependency vulnerability fixes (automated)

Generated by the Devin Dependency Security Vuln Fix automation run on 2026-10-19 (first opened 2026-09-28).
Change type: Major version bump(s), manifest/lockfile only.

Warning

We're not just looking for a review like a normal PR. Security can offer this fix as a recommendation, but doesn't have the tooling or domain knowledge to safely verify changes like this end-to-end for each repo. Please review, test, and own deployment before merging. For more information: https://launchdarkly.atlassian.net/wiki/spaces/SEC/pages/5360943572/Dependency+Vulnerability+Remediation+with+Devin.

Findings addressed

Package	Ecosystem	Bump type	Current → Target	Severity	Age	Source(s)	Advisory
nanoid (packages/web-extension)	npm	Major	^4.0.0 → ^5.1.16	High	130d	Dependabot, Wiz	GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w, GHSA-mwcw-c2x4-8c55 / CVE-2024-55565 (Dependabot #93–#96)
vitest (11 workspace packages)	npm	Major	^3.2.6 → ^4.1.11	Medium	39d	Dependabot, Wiz	GHSA-82fw-gwwq-j7x9 (Dependabot #97–#107)

Notes for reviewers:

• The repo has no committed lockfile (/yarn.lock is gitignored and the lockfile is owned by launchdarkly/observability-sdk), so this PR only changes manifests. A fresh install resolves nanoid 5.1.16 and vitest 4.1.11. vite stays on ^6.4.2, since vitest 4.1.11 supports vite 6, 7 and 8.
• nanoid 5 is ESM-only. web-extension only uses the named nanoid export in ESM/Vite code, and the extension builds.
• Overlaps with Dependabot chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates #32 on the nanoid line. That PR sets ^5.1.11, which leaves the manifest floor inside alert #95's vulnerable range (< 5.1.16). Whichever PR merges second needs a trivial conflict fix.
• Supersedes the vitest part of Dependabot chore(deps-dev): bump the npm_and_yarn group across 2 directories with 1 update #33. That PR targets ^4.1.8, which is still inside the < 4.1.11 vulnerable range, and it also bumps vite to 8.
• vitest.workspace.ts uses defineWorkspace, which vitest 4 removed. No script references the file, because each package runs its own vitest.config.ts via turbo, so it was left untouched.
• 2026-10-12: merged main (fix(record): resync replaces grown sheets instead of re-sending the tail #42, stylesheet resync fix). No new findings for this group.
• 2026-10-19: merged main (fix(record): resync sends only the rules the replayer is missing #43, stylesheet resync change in packages/record). No new findings for this group. Wiz was unavailable this run.

Deferred / excluded findings

• Major that needs a config change, so it has its own PR: svelte (packages/rrweb-player) ^4.2.14 → ^5.55.7, Medium, 241d (Dependabot #52–#55, #75, #76). See fix: bump svelte to ^5.55.7 in rrweb-player (dependency vulnerabilities) #44. Dependabot chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates #32 only bumps svelte, which breaks the player's class component API at runtime.
• Major that needs a source change, so it has its own PR: react-router (packages/web-extension, via react-router-dom) 6.30.6 → 7.18.4, Medium, Wiz only (CVE-2026-53666, CVE-2026-53669). See fix: bump react-router-dom to ^7.18.0 in web-extension (dependency vulnerabilities) #41.

Verification

Re-checked on 2026-10-19 after merging main:

• Install: ✅ yarn install resolves nanoid 5.1.16 and vitest 4.1.11. The only failure is packages/rrvideo's Playwright browser postinstall, which can't reach the Playwright CDN from the automation sandbox. This happens on main too.
• Build: ✅ yarn build:all passes 22/22. Locally, web-extension's manifest schema validation had to be skipped because the sandbox can't fetch the schema; that change isn't committed.
• Tests: ✅ yarn test on vitest 4 matches main locally, with one exception. rrweb cross-origin-iframes.test.ts > should map input events correctly fails in the sandbox's headless Chrome, but run on its own it fails on main too, so it's an environment issue. The other local failures, in rrdom, rrweb and rrvideo, are the same as on main. CI runs the full suite on this head.
• Lint: ✅ yarn lint has no new errors. The only errors are the same 3 rrweb-player .svelte parser errors as on main.

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring